Network security devices may be used to process a large number of connections. Each connection may be associated with descriptive metadata, which may include, but is not limited to: the connection source, destination, port, security policy, connection duration, connection timing, bandwidth, quality of service, and so on. Monitoring connections may, therefore, require gathering, transferring and/or displaying a large amount of data. Moreover, even if such data were capable of being efficiently transferred and/or displayed, the volume of information may overwhelm the user.